nmap from python
0x01 About
大家都比较熟悉nmap，nmap是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统（这是亦称 fingerprinting）。它是网络管理员必用的软件之一，以及用以评估网络系统安全。
今天分享一下python-nmap，是python的一个模块库，使用这个模块可以让python很方便的操作nmap扫描器来工作，它可以帮助管理员完成自动扫描任务和生成报告的工具，它还支持nmap的脚步输出。
python-nmap只提供了nmap中的端口扫描，但输出方式会让人便于信息整理。
前提：使用python-nmap你得先装有nmap该软件
Install from PIP
|
1 |
pip install python-nmap |
0x02 Usage
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
#!/usr/bin/env python import nmap # import nmap.py module nm = nmap.PortScanner() # instantiate nmap.PortScanner object nm.scan('127.0.0.1', '22-443') # scan host 127.0.0.1, ports from 22 to 443 nm.command_line() # get command line used for the scan : nmap -oX - -p 22-443 127.0.0.1 nm.scaninfo() # get nmap scan informations {'tcp': {'services': '22-443', 'method': 'connect'}} nm.all_hosts() # get all hosts that were scanned nm['127.0.0.1'].hostname() # get one hostname for host 127.0.0.1, usualy the user record nm['127.0.0.1'].hostnames() # get list of hostnames for host 127.0.0.1 as a list of dict # [{'name':'hostname1', 'type':'PTR'}, {'name':'hostname2', 'type':'user'}] nm['127.0.0.1'].hostname() # get hostname for host 127.0.0.1 nm['127.0.0.1'].state() # get state of host 127.0.0.1 (up|down|unknown|skipped) nm['127.0.0.1'].all_protocols() # get all scanned protocols ['tcp', 'udp'] in (ip|tcp|udp|sctp) nm['127.0.0.1']['tcp'].keys() # get all ports for tcp protocol nm['127.0.0.1'].all_tcp() # get all ports for tcp protocol (sorted version) nm['127.0.0.1'].all_udp() # get all ports for udp protocol (sorted version) nm['127.0.0.1'].all_ip() # get all ports for ip protocol (sorted version) nm['127.0.0.1'].all_sctp() # get all ports for sctp protocol (sorted version) nm['127.0.0.1'].has_tcp(22) # is there any information for port 22/tcp on host 127.0.0.1 nm['127.0.0.1']['tcp'][22] # get infos about port 22 in tcp on host 127.0.0.1 nm['127.0.0.1'].tcp(22) # get infos about port 22 in tcp on host 127.0.0.1 nm['127.0.0.1']['tcp'][22]['state'] # get state of port 22/tcp on host 127.0.0.1 (open |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
# a more usefull example : for host in nm.all_hosts(): print('----------------------------------------------------') print('Host : %s (%s)' % (host, nm[host].hostname())) print('State : %s' % nm[host].state()) for proto in nm[host].all_protocols(): print('----------') print('Protocol : %s' % proto) lport = nm[host][proto].keys() lport.sort() for port in lport: print('port : %s\tstate : %s' % (port, nm[host][proto][port]['state'])) print('----------------------------------------------------') # print result as CSV print(nm.csv()) print('----------------------------------------------------') # If you want to do a pingsweep on network 192.168.1.0/24: nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389') hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()] for host, status in hosts_list: print('{0}:{1}'.format(host, status)) print '----------------------------------------------------' # Asynchronous usage of PortScannerAsync nma = nmap.PortScannerAsync() def callback_result(host, scan_result): print '------------------' print host, scan_result nma.scan(hosts='192.168.1.0/30', arguments='-sP', callback=callback_result) while nma.still_scanning(): print("Waiting ...") nma.wait(2) # you can do whatever you want but I choose to wait after the end of the scan |
创建PortScanner,扫描本机22-443端口，输出简单信息
|
1 2 3 4 5 6 7 |
>>> import nmap >>> nm = nmap.PortScanner() >>> nm.scan('127.0.0.1', '22-443') >>> nm.command_line() 'nmap -oX - -p 22-443 -sV 127.0.0.1' >>> nm.scaninfo() {'tcp': {'services': '22-443', 'method': 'connect'}} |
查看host/协议
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
>>> nm.all_hosts() ['127.0.0.1'] >>> nm['127.0.0.1'].hostname() 'localhost' >>> nm['127.0.0.1'].state() 'up' >>> nm['127.0.0.1'].all_protocols() ['tcp'] >>> nm['127.0.0.1']['tcp'].keys() [80, 25, 443, 22, 111] >>> nm['127.0.0.1'].has_tcp(22) True >>> nm['127.0.0.1'].has_tcp(23) False >>> nm['127.0.0.1']['tcp'][22] {'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'} >>> nm['127.0.0.1'].tcp(22) {'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'} >>> nm['127.0.0.1']['tcp'][22]['state'] 'open' |
python-nmap官网：http://xael.org/pages/python-nmap-en.html
近期评论